Microsoft and Google Dismantled RedVDS Marketplace
Tech giants disrupted a platform that targeted 130,000 organizations and compromised thousands of email accounts.
Updated on Sept. 21, 2026 in Cybersecurity
Live Poll
Do you trust that large technology companies adequately protect your accounts from cybercrime threats?
In January 2026, Microsoft and Google successfully dismantled the RedVDS cybercrime marketplace. The platform provided virtual machines used for widespread phishing and business email compromise attacks.
Why it matters
RedVDS enabled automated cyberattacks at scale by offering infrastructure for as little as $24 per month. By disrupting the service, the companies aimed to neutralize a tool responsible for compromising 191,000 email accounts.
RedVDS sold virtual machines running unlicensed software for $24 per month to facilitate cyberattacks. These tools were instrumental in targeting 130,000 organizations between September and December 2025.
The players
Microsoft
This multinational technology corporation provides software, services, and hardware and operates the Digital Crimes Unit.
This global technology company focuses on internet-related services, including cloud computing and web search, and collaborated on the takedown.
Europol
This is the European Union agency for law enforcement cooperation that assisted in the server seizures.
Global Signal Exchange
This UK-based non-profit organization was founded in 2025 to facilitate threat data sharing between technology companies.
The details
Microsoft Digital Crimes Unit and Google identified the marketplace through data sharing via the Global Signal Exchange. The operation involved seizing web domains in the United States and the United Kingdom, alongside Europol impounding physical servers in Germany.
Timeline
Between September and December 2025, RedVDS targeted 130,000 organizations.
In 2025, the Global Signal Exchange was co-founded.
In January 2026, Microsoft initiated disruptive action and sought domain seizures.
The Tech Race
This takedown signals a shift toward collaborative defense strategies coordinated through institutions like the Global Signal Exchange. By standardizing threat data sharing, major tech firms are effectively shrinking the operational lifespan of criminal marketplaces.
The disruption of RedVDS helps secure personal and business email communications by removing the underlying infrastructure used for phishing. Users should continue to monitor account security, as compromised credentials may have been distributed to other actors prior to the takedown.
The takeaway
Large-scale cybercrime marketplaces rely on affordable, scalable infrastructure to sustain their operations. Disrupting these networks requires persistent international cooperation between technology providers and law enforcement agencies.
Further reading
For more information on how tech companies collaborate to mitigate digital threats, visit the Cybersecurity section.
Live Poll
Do you trust that large technology companies adequately protect your accounts from cybercrime threats?
